I have been getting this exception with V3.0.9 and decided to look into it a bit.
UPnP: Cannot be negative.
Parameter name: length
UnityEngine.Debug:LogError(Object)
TNet.UPnP:ThreadDiscover(Object) (at Assets/TNet/Common/TNUPnP.cs:193)
It gets thrown when the baseUrl in ParseResponse is "
http://192.168.0.12:9080". The issue is caused in line 227. The code is trying to find the first slash after the http:// and fails to accomodate for the case when there is none by subsequently calling
mGatewayURL = baseURL.Substring(0, offset);
with an offset of -1.
I hope posting one line of proprietary source does not get me banned. :-P